New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Google Cloud Recipe Auth

by google in google/skills

Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for…

OfficialApache-2.0Auto-check passed

Install Google Cloud Recipe Auth

skills CLI
$ npx skills add google/skills --skill google-cloud-recipe-auth -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install google/skills google-cloud-recipe-auth --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/google/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/cloud/google-cloud-recipe-auth .claude/skills/google-cloud-recipe-auth && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
google-cloud-recipe-auth
GitHub stars
21k
Used in
1 other repo
Token cost
~3.1k tokens
SKILL.md length
1,271 words
Files
1
Skills in repo
145
Repo updated
First seen
Licence
Apache-2.0

At a glance

Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for…

  • Works in 4 steps: Who or what is authenticating? (A human… → Where is the code running? (Local… → What is the target? (A Google Cloud API… → …
  • SKILL.md covers Authentication, Human Authentication, Service-to-Service… and Authorization, plus 3 more sections
  • Calls gcloud; needs GOOGLE_APPLICATION_CREDENTIALS

What it does

Google Cloud Recipe Auth is an agent skill from google/skills, published by the product's own GitHub organization. Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

Its SKILL.md is about 3.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It works with Google Cloud. The repository describes itself as: Agent Skills for Google products and technologies. The licence is Apache-2.0.

Example prompts

  • “Use the google-cloud-recipe-auth skill to provide expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering…”
  • “/google-cloud-recipe-auth”

Requirements

  • Python 3
  • Node.js

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Who or what is authenticating? (A human developer, a local script, or an
  2. Where is the code running? (Local laptop, [Compute
  3. What is the target? (A Google Cloud API like Storage/BigQuery, or a
  4. Are you using a high-level client library? (e.g., Python, Go, Node.js

What it can do on your machine

Read from SKILL.md and the folder at commit 8a1ac05. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gcloud

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • docs.cloud.google.com
    • console.cloud.google.com
    • workspace.google.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • GOOGLE_APPLICATION_CREDENTIALS

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Google Cloud Recipe Auth loads about 3.1k tokens when it runs. Until then it costs about 59 tokens; SKILL.md has 1,271 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~59
When it runs · the whole SKILL.md, loaded when a task matches
~3.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from google/skills at commit 8a1ac05, republished under its Apache-2.0 licence (© google). 1,271 words, ~3,059 tokens.

Download SKILL.mdSave it as .claude/skills/google-cloud-recipe-auth/SKILL.md (or your agent's skills folder).
name
google-cloud-recipe-auth
description
Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.
metadata.version
1.0.0
metadata.category
GettingStarted

Authenticating to Google Cloud

Authentication is the process of proving who you are. In Google Cloud, you represent a Principal (an identity like a user or a service). This is the first step before Authorization (determining what you can do).

Authentication

Clarifying Questions for the Agent

Before providing a specific solution, clarify the following with the user:

  1. Who or what is authenticating? (A human developer, a local script, or an application running in production?)
  2. Where is the code running? (Local laptop, Compute Engine, GKE, Cloud Run, or another cloud like AWS/Azure?)
  3. What is the target? (A Google Cloud API like Storage/BigQuery, or a custom application you built?)
  4. Are you using a high-level client library? (e.g., Python, Go, Node.js libraries usually handle ADC automatically.)

Human Authentication

For users to access Google Cloud, they need an identity that Google Cloud can recognize.

Types of User Identities

Google Cloud supports several ways to configure identities for your internal workforce (developers, administrators, employees):

  • Google-Managed Accounts: You can use Cloud Identity or Google Workspace to create managed user accounts. These are called managed accounts because your organization controls their lifecycle and configuration.
  • Federation using Cloud Identity or Google Workspace: You can federate identities to allow users to use their existing identity and credentials to sign in to Google services. Users authenticate against an external identity provider (IdP), but you must keep accounts synchronized into Google Cloud using tools like Google Cloud Directory Sync (GCDS) or an external authoritative source like Active Directory or Microsoft Entra ID.
  • Workforce Identity Federation: This lets you use an external IdP to authenticate and authorize a workforce using IAM directly. Unlike standard federation, you do not need to synchronize user identities from your existing IdP to Google Cloud identities. It supports syncless, attribute-based single sign-on.
Methods of Access for Developers and Administrators

Used for interacting with Google Cloud resources and APIs during development and management.

  • Google Cloud Console: The primary web interface. You authenticate using your Google Account (Gmail or Google Workspace).
  • gcloud CLI (gcloud auth login): Used to authenticate the CLI itself so you can run management commands (e.g., gcloud compute instances list). It uses a Credential (like an OAuth 2.0 refresh token) stored locally.
  • Local Development with App Default Credentials (ADC) (gcloud auth application-default login): This is different from CLI auth. It creates a local JSON file that Google Cloud Client Libraries (Python, Java, etc.) use to act as "you" when you run code on your laptop.
  • Service Account Impersonation: For security reasons, developers should avoid downloading Service Account keys entirely. Instead, they should authenticate as humans (gcloud auth login) and use Service Account Impersonation to run CLI commands or generate short-lived credentials. This is a critical best practice for local development and troubleshooting.
For End-Users and Customers

Used when a human (who is not a developer) needs to access a web application you've deployed on Google Cloud. Note: These are distinct from workforce identities.

  • Identity-Aware Proxy (IAP): Acts as a central authorization layer for web applications. It intercepts web requests and verifies the user's identity (via Google Workspace, Cloud Identity, or external providers) before letting them reach the application. It's often used to protect internal apps without a VPN, or secure customer portals.
  • Identity Platform: A Customer Identity and Access Management (CIAM) solution for adding consumer sign-in (email/password, phone, social) directly into the code of your custom-built applications.

Service-to-Service Authentication

When code runs in production, it should use a Service Account rather than a human user account.

Service Accounts and Service Agents
  • Service Account: A special identity intended for non-human users. It's like a "robot identity" with its own email address.
  • Service Agent: A service account managed by Google that allows a service (like Pub/Sub) to access your resources on your behalf.
Best Practice: Attaching Service Accounts

Instead of using Service Account Keys (dangerous JSON files), you should attach a custom service account to the Google Cloud resource. The resource's environment then provides a Token (a short-lived digital object) via a local metadata server.

  • Compute Engine: Assign a service account during VM creation.
  • Cloud Run: Assign a service account in the service configuration.
Special Cases & Advanced Topics
Kubernetes Engine (GKE)

Use Workload Identity Federation for GKE to map Kubernetes identities to IAM principal identifiers. This grants specific Kubernetes workloads access to specific Google Cloud APIs. Learn more here.

External Workloads (Workload Identity Federation)

For code running outside Google Cloud (e.g., AWS, Azure, or on-prem), do not use keys. Instead, use Workload Identity Federation to exchange an external token (like an AWS IAM role) for a short-lived Google Cloud access token.

Show full SKILL.md (504 more words)Show less
API Keys

API keys are encrypted strings used for public data (e.g., Google Maps) or simplified access like Vertex AI Express Mode, which allows fast testing of Gemini models without complex setup. Both humans and services (e.g., Cloud Run-based AI agent) can use API keys, for the services that support it.

Note: API keys should be restricted to specific APIs and projects to minimize security risks. Store API keys in a secrets manager like Secret Manager to prevent accidental exposure.

OAuth 2.0 Access Scopes

While IAM is the modern way to handle authorization, legacy Compute Engine VMs and GKE node pools still rely on Access Scopes alongside IAM. If a VM's scope is restricted, the attached service account will fail to make API calls even if it has the correct IAM permissions. Check this first if attached service accounts are failing unexpectedly.

Short-Lived Credentials

The underlying mechanism for impersonation and secure service-to-service communication is the IAM Service Account Credentials API. This API generates short-lived access tokens, OpenID Connect (OIDC) ID tokens, or self-signed JSON Web Tokens (JWTs) dynamically, removing the need for static credentials.

Authorization

After Authentication, Google Cloud uses Identity and Access Management (IAM) to determine what the authenticated principal can do.

  • Allow Policy: A record that binds a Principal to a Role on a Resource.
  • Predefined Roles: Prebuilt roles like roles/storage.objectViewer or roles/bigquery.dataEditor. Always try to use these first.
  • Custom Roles: User-defined collections of specific permissions if predefined roles are too broad.

Examples

Human-to-Service (Local Python Development)
  1. Authn: Run gcloud auth application-default login to create local credentials (ADC).
  2. Authz: Grant your email the roles/storage.objectViewer role on a bucket.
  3. Code: Use the Python storage.Client(). It automatically finds your local credentials via ADC. Note: ADC searches in a specific order—first checking the GOOGLE_APPLICATION_CREDENTIALS environment variable, then the local gcloud JSON file, and finally the attached service account metadata server.
Service-to-Service (Cloud Run to Cloud SQL)
  1. Authn: Attach a custom Service Account to your Cloud Run service.
  2. Authz: Grant that Service Account the roles/cloudsql.client role on the project.
  3. Code: The Cloud Run environment provides the token automatically to the connection driver.
Calling a Custom Application (OIDC)

When calling a private Cloud Run service from another service, the caller generates a Google-signed OpenID Connect (OIDC) ID Token and passes it in the Authorization: Bearer <TOKEN> header.

Validation Checklist

  • Is the user running code locally? Suggest gcloud auth application-default login or Service Account Impersonation.
  • Is the user attempting to use Service Account keys locally? Strongly discourage this and recommend impersonation.
  • Is the user running in production? Recommend attaching a custom, least-privilege service account, NOT using keys.
  • Is the user relying on the Compute Engine Default Service Account? Recommend creating a custom service account instead.
  • Is the user running on another cloud? Recommend Workload Identity Federation.
  • Is the user calling a custom app? Recommend OIDC ID Tokens.
  • Has the user restricted their API Keys? Check for appropriate API Key Restrictions.

References

© google, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/cloud/google-cloud-recipe-auth of google/skills.

Open the folder on GitHubat commit 8a1ac05

Used in 1 other repository

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in google/skills, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Google Cloud Recipe Auth next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Google Cloud Recipe Auth compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Google Cloud Recipe Auth this skillgoogle/skills21k1 repos~3.1kAutomated safety check: PassApache-2.0
Gmail Inbox Watchergoogleworkspace/cli31k1 repos~476Automated safety check: PassApache-2.0
Cloud Cost Optimizationwshobson/agents40k13 repos~1.7kAutomated safety check: PassMIT
Senior DevOps Toolkitmaslennikov-ig/claude-code-orchestrator-kit2596 repos~1.1kAutomated safety check: NotesCustom licence
Terravision Cloud Diagramspatrickchugh/terravision1.6k—~5.6kAutomated safety check: NotesAGPL-3.0-only
Kiln Check DeprecationKiln-AI/Kiln5.2k—~2.5kAutomated safety check: NotesCustom licence

Similar skills

  • Gmail Inbox Watcher

    googleworkspace/cli

    Streams new Gmail messages as NDJSON from the gws command line tool using Google Pub/Sub, with label filters, batch settings and optional per-message files.

    31k GitHub starsUsed in 1 repo~476 tokens
    Productivity & AutomationAuto-check passed

  • Cloud Cost Optimization

    wshobson/agents

    Cuts cloud spend across AWS, Azure, GCP and OCI with cost tagging, rightsizing, commitment and spot pricing models, and architecture changes.

    40k GitHub starsUsed in 13 repos~1.7k tokens
    DevOps & CloudAuto-check passed

  • Senior DevOps Toolkit

    maslennikov-ig/claude-code-orchestrator-kit

    Comprehensive DevOps skill for CI/CD, infrastructure automation, containerization, and cloud platforms (AWS, GCP, Azure). Includes pipeline setup…

    259 GitHub starsUsed in 6 repos~1.1k tokens
    DevOps & CloudAuto-check: notes

  • Terravision Cloud Diagrams

    patrickchugh/terravision

    Draw cloud architecture diagrams for AWS, Azure or GCP with the official provider icon sets, using TerraVision.

    1.6k GitHub stars~5.6k tokensUpdated today
    DevOps & CloudAuto-check: notes

  • Kiln Check Deprecation

    Kiln-AI/Kiln

    Check Kiln's model list for deprecated or sunset models across all providers.

    5.2k GitHub stars~2.5k tokensUpdated today
    AI & LLM EngineeringAuto-check: notes

  • Windmill Trigger Type Checklist

    windmill-labs/windmill

    Checklist of every backend, frontend, CLI and capture change needed to add a new TriggerCrud-based trigger type, such as Azure, GCP or Kafka, to Windmill.

    18k GitHub stars~4.7k tokensUpdated today
    Backend & APIsAuto-check passed

More from google/skills

All 145 skills in this repo

  • Google Cloud PAM Helper

    google/skills

    Official

    Manages Google Cloud Privileged Access Manager entitlements and grants: create and edit entitlements, request temporary access, and approve or deny pending grants.

    21k GitHub stars~3.2k tokensUpdated today
    Auto-check passed

  • Agent Platform Alert Configuration

    google/skills

    Official

    Writes Terraform alerting policies for AI agents that emit OpenTelemetry metrics, covering reliability, cost, safety, security and quality signals on Google Cloud.

    21k GitHub stars~4.2k tokensUpdated today
    Auto-check passed

  • Model Garden Deployment

    google/skills

    Official

    Deploys open models or custom weights from Model Garden to Agent Platform endpoints, checks deployment status and cleans up endpoints, confirming before any change.

    21k GitHub stars~5.1k tokensUpdated today
    Auto-check passed

  • Agent Platform Skill Registry

    google/skills

    Official

    Searches, manages and scaffolds skills in the Gemini Enterprise Agent Platform Skill Registry using bundled Python scripts and Google Cloud credentials.

    21k GitHub stars~584 tokensUpdated today
    Auto-check passed

  • GCP Application Design Center Deploy

    google/skills

    Official

    Designs GCP infrastructure as local Terraform, validates and scans it against best practices, then imports it to Application Design Center for deployment and troubleshooting.

    21k GitHub stars~4.4k tokensUpdated today
    Auto-check passed

  • BigQuery Slot and Cost Optimizer

    google/skills

    Official

    Analyzes BigQuery slot use, query costs and execution bottlenecks from INFORMATION_SCHEMA to diagnose slow queries, slot contention and unpartitioned scans.

    21k GitHub stars~2.3k tokensUpdated today
    Auto-check passed

Works with

Questions about Google Cloud Recipe Auth

What does Google Cloud Recipe Auth do?

Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for…. Google Cloud Recipe Auth is an agent skill from google/skills, published by the product's own GitHub organization. Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

How do I install Google Cloud Recipe Auth in Claude Code?

Run `npx skills add google/skills --skill google-cloud-recipe-auth -a claude-code`. Or copy the skill folder (skills/cloud/google-cloud-recipe-auth in google/skills) into .claude/skills/google-cloud-recipe-auth in your project. Claude Code loads it when a task matches its description.

How do I install Google Cloud Recipe Auth in Codex?

Run `npx skills add google/skills --skill google-cloud-recipe-auth -a codex`. Or copy the skill folder (skills/cloud/google-cloud-recipe-auth in google/skills) into .agents/skills/google-cloud-recipe-auth in your project. Codex loads it when a task matches its description.

Can I use Google Cloud Recipe Auth in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add google/skills --skill google-cloud-recipe-auth -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/google-cloud-recipe-auth, .gemini/skills/google-cloud-recipe-auth, .github/skills/google-cloud-recipe-auth and .opencode/skills/google-cloud-recipe-auth in your project.

What does Google Cloud Recipe Auth need to run?

Going by SKILL.md and its folder, Google Cloud Recipe Auth needs the command-line tools its instructions call (gcloud) and credentials named GOOGLE_APPLICATION_CREDENTIALS. Our summary lists: Python 3; Node.js.

Does Google Cloud Recipe Auth access the network?

SKILL.md names 3 domains. As links in the text: docs.cloud.google.com, console.cloud.google.com and workspace.google.com. This is read from the text; nothing was executed.

Is Google Cloud Recipe Auth safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Google Cloud Recipe Auth use?

Google Cloud Recipe Auth is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Google Cloud Recipe Auth use?

About 3.1k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Google Cloud Recipe Auth?

Skills that share tags, products or a category with Google Cloud Recipe Auth: Gmail Inbox Watcher (googleworkspace/cli, 31k stars), Cloud Cost Optimization (wshobson/agents, 40k stars), Senior DevOps Toolkit (maslennikov-ig/claude-code-orchestrator-kit, 259 stars) and Terravision Cloud Diagrams (patrickchugh/terravision, 1.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Google Cloud Recipe Auth?

google (a GitHub organization, an official publisher) maintains it in google/skills, which has 20,994 GitHub stars. The repository holds 145 skills in this directory. The repository was last updated on October 6, 2026.

Source: google/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.